CVE-2026-26021: Prototype Pollution Via Includes Guardcve-2026-26021-prototype-pollution-via-includes-guard
Using `Array.prototype.includes()` to guard against prototype-pollution keys ('__proto__', 'constructor', 'prototype') is bypassable. An attacker who can execute JavaScript in the same realm before this guard runs can shadow `Array.prototype.includes` (e.g., `Array.prototype.includes = () => false`), causing the check to silently pass and allowing the forbid
